Privacy Notice

ANDYL may collect identifiers and contact information, account and authentication information, internet or network activity, communications, organization and authorization records, public open-source activity, and contributor-agreement information. We collect these categories directly from you, automatically from your browser or device, from an organization that authorizes your access, and from services you use to authenticate or interact with us.

We use this information to operate and secure our Sites, authenticate users, provide public registry and open-source community functions, administer contributor agreements, communicate with you, understand aggregate Site use, and meet legal obligations. Retention depends on the purpose and is described below and in the CLA Privacy Supplement.

Andyl, Inc., a Delaware corporation (ANDYL, we, us, or our), controls the personal information described in this notice. This notice applies to andyl.com, andyl.org, aos.andyl.org, related ANDYL-operated APIs, and other ANDYL-controlled websites or community services that link to it (collectively, the Sites).

The contributor-agreement service at cla.andyl.org is also covered by a more specific CLA Privacy Supplement. That supplement controls if its terms differ from this notice for contributor-agreement information.

Third-party platforms and websites have their own privacy practices. For example, GitHub governs information it collects through github.com, and a recruiting provider governs information submitted through its application service. This notice covers information ANDYL receives from those services, not their independent processing.

We use personal information to:

• provide, maintain, and improve the Sites and their public or account-based features;
• authenticate users, maintain sessions, issue credentials, and enforce permissions;
• operate public registries and preserve the integrity and provenance of published artifacts;
• administer open-source projects, contributions, contributor authorization, and legal evidence;
• respond to questions, requests, security reports, and other communications;
• monitor aggregate Site use, diagnose errors, prevent abuse, and protect users and systems;
• establish, exercise, or defend legal claims and enforce applicable terms; and
• comply with law, lawful requests, and regulatory obligations.

Where European data-protection law applies, our legal bases are performance of a contract or steps requested before entering one; our legitimate interests in operating secure Sites, administering open-source projects, communicating, and protecting legal rights; compliance with legal obligations; and consent where we specifically request it. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

We may disclose information to:

• Infrastructure and service providers, including Vercel for hosting and analytics, Cloudflare for hosting, storage, networking, and security, Google Cloud for the contributor-agreement API and records, and providers that deliver email or support Site operations.
• Identity and collaboration providers, including GitHub, Google, or an organization’s identity provider when you ask to authenticate or connect an account.
• Your organization, when it administers your account, membership, registry, or authorization.
• Professional advisers and authorities, when reasonably necessary for legal, accounting, security, or compliance purposes or to respond to lawful process.
• Transaction participants, in connection with a financing, reorganization, acquisition, or transfer of all or part of our business, subject to appropriate confidentiality protections.

Information intentionally submitted to a public registry, repository, issue, pull request, commit history, or other public feature is visible to the public and may be copied or retained by others. Do not submit information you do not want made public through those features.

andyl.com uses Vercel Web Analytics to measure aggregate page use. According to Vercel, the service does not use third-party cookies, does not associate analytics events with an individual or IP address, and discards its visitor identifier after 24 hours. You can review Vercel’s analytics privacy documentation.

Account and contributor services use cookies that are necessary for sign-in, security, OAuth state, invitations, and sessions. They may also use temporary browser storage to preserve an in-progress operation across a retry. These technologies are not used for advertising. Blocking required cookies or browser storage may prevent authentication or other requested features from working.

The Sites do not currently use interest-based advertising, advertising pixels, or session-replay technology. If that changes, we will update this notice and provide any controls required by applicable law before deploying the technology.

We retain information for the shortest period reasonably necessary for the purposes described here, taking account of security, operational, legal, accounting, and dispute-resolution needs.

• Account, membership, authentication, and authorization information is retained while needed to provide and secure the account and for a reasonable period afterward.
• Sessions, magic links, challenges, and access credentials expire or are revoked according to their configuration. Security and audit events may be kept longer to investigate abuse and protect systems.
• Public repositories, registry metadata, release history, contribution records, and other public records may be retained indefinitely to preserve project history, provenance, security, and license compliance. Copies may remain in forks, mirrors, caches, and third-party archives outside our control.
• Communications are retained while needed to respond and for reasonable follow-up, legal, or security purposes.
• Contributor-agreement and contact-form retention is described in the CLA Privacy Supplement.

When information is no longer needed, we delete it, anonymize it, or isolate it from further use. Residual copies may remain temporarily in backups or where deletion is restricted by law, security needs, or an immutable legal record.

We use administrative, technical, and organizational safeguards designed to protect personal information. No system or transmission is completely secure, and we cannot guarantee absolute security. If you believe information or an account has been compromised, contact security@andyl.com.

ANDYL is based in the United States. We and our providers may process information in the United States and other countries whose laws may differ from those where you live. Where applicable law requires a transfer mechanism, we use an approved legal mechanism or another permitted basis for the transfer. Contact us for information about a mechanism applicable to your information.

Depending on where you live and whether the relevant law applies to ANDYL, you may have rights to request information about our processing; access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; or appeal our response to a request. These rights are subject to exceptions, including where information must be retained to preserve a public record, administer an agreement, protect security, comply with law, or establish or defend legal claims.

You may use an authorized agent where permitted by law. We may ask for information reasonably necessary to verify identity, authority, residency, or the scope of a request. If we deny a request, you may appeal by replying to our decision and identifying the basis for the appeal.

We do not sell personal information or process it for targeted advertising or legally significant profiling. Because we do not engage in those practices, there is currently no sale or targeted-advertising opt-out to exercise. We will recognize legally required browser-based opt-out signals if our practices change.

Individuals in the European Economic Area or United Kingdom may also lodge a complaint with the data-protection authority where they live or work. We encourage you to contact us first so we can try to address the concern.

The Sites are not directed to children under 13, and we do not knowingly collect personal information from them. Accounts, contributor agreements, and features that create legal obligations are intended only for people who are at least 18 or the age of legal majority where they live. Contact us if you believe a child provided personal information contrary to this notice.

We may update this notice as our Sites and practices change. We will post the revised notice, update the effective date, and provide additional notice when appropriate. Material changes apply prospectively. Previous versions are available by contacting us.

To ask a privacy question or exercise an applicable right, email privacy@andyl.com. Please describe your request and the Site or account involved. You may also contact Andyl, Inc. through the contact method published on the relevant Site.